Your work is yours.
We help you look after it.

This policy applies to the trulyform website, editor, account area, published forms, and related services (together, the “Service”). In this policy, “trulyform”, “we”, “us”, and “our” mean Paulo Steinberg, operating the Service under the name trulyform.

1. The short version

We collect only what we need to run the Service, help you use it, keep it secure, and understand whether it is useful. You decide what to put in a form and who can answer it. If you answer someone else’s form, that form’s creator is normally responsible for deciding why your answers are collected and how they are used; trulyform processes those answers to provide the Service to the creator.

2. Information we receive

• Account and organization information. Your name, email address, password or sign-in details, organization name, team membership, and security settings.
• Forms and creator content. Form titles, questions, logic, themes, logos, uploaded assets, publication settings, and drafts.
• Responses and files. Answers, partial responses, completion details, respondent files, and any other information a creator chooses to collect through a form. A form creator may collect sensitive information, so please read that creator’s own privacy notice before answering.
• Connected accounts. If you connect another service, such as Google, Slack, HubSpot, Notion, or Airtable, the account name or email address it shares with us, the destinations you choose, and the access tokens it issues to trulyform.
• Billing information. Subscription and payment status. Card details are handled by our payment provider rather than stored as full card numbers by trulyform.
• Messages to us. If you use the contact form on our website, we receive the name, email, company, and message you provide. If you message us from inside your account, we receive your message, the reply channel you choose, your WhatsApp number if you choose WhatsApp, the page you were on, and a link to the session replay of that moment. If you choose WhatsApp, the founder replies from his own WhatsApp, so WhatsApp (Meta) processes that conversation. We keep these messages until your account is deleted.
• Technical information. Our hosting, security, and delivery infrastructure may receive information such as IP address, browser and device details, request timestamps, and error or security events.
• Browser storage. The editor can save drafts in your browser so you can keep working, and a published form can remember a pseudonymous respondent identifier in that browser to support continuity across forms from the same organization. You can clear browser storage through your browser settings.

3. How we use information

• to create, save, publish, display, and manage forms and responses;
• to authenticate accounts, support organizations, recover work, and send transactional messages;
• to process subscriptions, invoices, usage allowances, and payment-related events;
• to store and deliver creator assets and respondent uploads, including private response files;
• to send responses to the integrations you connect;
• to prevent abuse, protect accounts and data, troubleshoot failures, and maintain the Service;
• to answer support and privacy requests; and
• to understand product usage and improve trulyform, where product analytics is enabled.

Depending on the circumstances and the law that applies to you, these uses may be based on performing our agreement with you, our legitimate interests in operating a secure service, your consent, or a legal obligation.

4. Form creators and respondents

When you create a form, you control the questions you ask, the information you collect, and the people or services with whom you share responses. You are responsible for providing respondents with any notice, consent, instructions, and rights process required for your use of their information.

When you answer a form, contact the organization or person who created it if you have questions about the form, want to access or delete your answers, or want to withdraw permission you gave that creator. We can help route a request when appropriate, but we generally cannot decide what a creator should do with its response data.

5. Integrations you connect

Members of an organization can connect trulyform to other services, such as Google Sheets, Google Drive, Slack, HubSpot, Notion, Airtable, or their own webhook endpoint. When a form uses an integration, trulyform sends each completed response, or for Google Drive the files uploaded with it, to the destination the member chose. The receiving service handles that data under its own terms and privacy policy.

Connecting an account gives trulyform an access token limited to the permissions you approve. We store these tokens encrypted and use them only to show you destinations during setup and to deliver responses to the destinations you choose. Disconnecting an account on the Integrations page deletes its stored tokens and asks the service to revoke trulyform’s access where the service supports it. You can also remove trulyform from the other service’s own settings at any time.

Google user data

Google Sheets and Google Drive share one Google connection. When you connect a Google account, trulyform receives your Google account ID and email address, so you can tell connected accounts apart, and access only to Google Drive files that trulyform creates or that you pick with Google’s file picker. trulyform cannot see or open any other file in your Google Drive.

We use this access only to provide the Google features you set up:

• for Google Sheets, to create a spreadsheet or open the one you picked, read its sheet names, header rows, and Response ID column so each response is added once and in the right columns, and add a row for each completed response; and
• for Google Drive, to create a folder or open the one you picked, check whether a file was already copied, and copy the files uploaded with each completed response into it.

We do not sell Google user data, use it for advertising, or use it to develop, train, or improve artificial intelligence or machine learning models. We do not share it except as needed to provide these features, to comply with law, or to protect the security of the Service, and people at trulyform do not read it unless you ask us to for support, or as needed for security or legal reasons. Disconnecting your Google account deletes its stored tokens and asks Google to revoke trulyform’s access. You can also remove access at any time from your Google Account’s third-party connections page.

trulyform’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI assistants you connect

You can connect an AI assistant, such as ChatGPT, to trulyform. To do so, you sign in to trulyform and approve access on our consent screen, which shows the assistant’s name, its return address, your account, and your organization. The assistant can then act only within that organization and with the permissions your account already has.

When you ask the assistant to work with your forms, trulyform sends it the information that request needs. Depending on the request, this can include:

• form details: names, status, questions, answer choices, logic, calculations, draft and publication information, and links to the editor;
• response details: response identifiers, status, form version, and start and completion times;
• respondent answers: what people entered in a form, which can include names, email addresses, phone numbers, dates, written answers, and anything else the form asks for, along with calculation results and the names and sizes of uploaded files; and
• the number of stored responses for a form.

trulyform does not send the assistant the contents of uploaded files or links to download them, private response metadata, your trulyform password or other sign-in credentials, or billing information. The assistant cannot delete forms or responses, or change billing or team members, through trulyform.

We use this access only to carry out the requests you make through the assistant. The company that provides the assistant receives the information described above and handles it under its own terms and privacy policy. For ChatGPT, that company is OpenAI. Our product analytics records that your account connected an assistant, along with the assistant’s name.

An assistant’s access lasts one hour at a time and is renewed automatically while you keep using it. It ends after 30 days without use. We keep a record of each connection while it is active and for up to 31 days after its last access expires, so that you can see and revoke it. You can revoke an assistant at any time in Settings → AI connections. Revoking stops further access but does not delete information the assistant has already received. To delete that information, use the assistant’s own controls.

6. Service providers

We use carefully selected providers to operate the Service. Depending on the features and deployment in use, these may include:

• Stripe for subscriptions, checkout, invoices, and payment administration;
• Google when you choose Google sign-in or connect Google Sheets or Google Drive;
• Resend or another configured mail provider for verification, notification, and support email;
• Cloudflare R2 or another configured storage provider for assets and uploads;
• Google Analytics for website traffic measurement on our public pages;
• WhatsApp (Meta) when you ask us to reply on WhatsApp;
• PostHog for limited product analytics and masked session replay when enabled; and
• Cloudflare and Sentry for delivery, security, and error reporting when configured.

These providers process information only as needed to provide their services, to comply with law, or as otherwise described in their own privacy notices. We may also disclose information when necessary to comply with law, respond to valid legal process, protect people or the Service, or enforce our agreements.

7. Product analytics

We use PostHog’s standard product analytics to understand page views, clicks, navigation, templates selected, pricing interactions, editor milestones, sign-up progress, and conversion failures.

PostHog records page layouts, clicks, scrolling, and navigation throughout the Service, including public pages, published forms, the editor, responses, sign-in and registration, and account settings. This helps us understand usage and improve the experience. We use PostHog’s standard input masking. Other visible page content can appear in recordings.

Website analytics

On our public website pages, we use Google Analytics cookies to understand how visitors find and use the site, including pages viewed, referring websites, campaign tags, device and browser type, and approximate location. Google receives technical information such as your IP address to provide this measurement. We remove other page address details before sending, and Google Analytics does not run in the editor, account area, or on published respondent forms.

Advertising measurement

We use Google Ads cookies to understand whether our ads lead to account creation, form publication, or a first completed response. Google may receive ad-click identifiers and technical information about these events. We do not send form questions, answers, uploaded files, passwords, or email addresses as advertising conversion data. Advertising measurement is disabled on published respondent forms.

8. Retention and deletion

We keep account, organization, form, response, and file data for as long as needed to provide the Service, comply with legal and financial obligations, resolve disputes, and protect the Service. We do not promise to delete responses or respondent files merely because they are partial, old, inactive, or associated with a plan that has changed. Authorized users can delete forms, responses, files, or accounts through the controls available in the Service; deletion may not immediately remove limited copies in backups, logs, or provider systems where retention is required for security, legal, or accounting reasons.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to withdraw consent where consent is the basis for processing. To make a request about information we control, contact us at legal@trulyform.com. We may need to verify your identity and may retain information where the law allows or requires it. You may also have the right to complain to your local privacy regulator.

10. Security and international processing

We use technical and organizational safeguards designed to protect information, including authenticated access controls, private response-file access, encrypted connections, and protected credentials. No online service can promise absolute security. Our providers and infrastructure may process information in countries other than the one where you live; where required, we use appropriate legal safeguards for those transfers.

11. Children

The Service is intended for people who can lawfully use it. Do not use trulyform to collect information from children unless you have the permission, notices, and safeguards required by applicable law.

12. Person in charge of the protection of personal information

Paulo Steinberg, founder of trulyform, is the person in charge of the protection of personal information. To ask a question, make a request, or raise a concern about personal information we hold, email legal@trulyform.com.

13. Changes and contact

We may update this policy as the Service changes. When a change is material, we will take reasonable steps to bring it to your attention. If you have a privacy question or request, email legal@trulyform.com or use the contact page.